org.springframework.security:spring-security-crypto@5.1.2.RELEASE vulnerabilities
-
latest version
6.3.1
-
latest non vulnerable version
-
first published
13 years ago
-
latest version published
2 months ago
-
licenses detected
- [3.1.0.RELEASE,)
-
package manager
Direct Vulnerabilities
Known vulnerabilities in the org.springframework.security:spring-security-crypto package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.| Vulnerability | Vulnerable Version |
|---|---|
org.springframework.security:spring-security-crypto is a spring-security-crypto library for Spring Security. Affected versions of this package are vulnerable to Integer Overflow or Wraparound when using the BCrypt class with the maximum work factor (31). In such a case, the encoder does not perform any salt rounds due to the overflow. Note: The default settings are not affected by this CVE. How to fix Integer Overflow or Wraparound? Upgrade |
[,5.5.7)
[5.6.0,5.6.4)
|
org.springframework.security:spring-security-crypto is a spring-security-crypto library for Spring Security. Affected versions of this package are vulnerable to Cryptographic Weakness. Spring Security was found to be a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack. How to fix Cryptographic Weakness? Upgrade |
[5.3.0.RELEASE,5.3.2.RELEASE)
[5.2.0.RELEASE,5.2.4.RELEASE)
[5.1.0.RELEASE,5.1.10.RELEASE)
[5.0.0.RELEASE,5.0.16.RELEASE)
[4.2.0.RELEASE,4.2.16.RELEASE)
|